{
  "Event": {
    "analysis": "1",
    "date": "2026-06-29",
    "extends_uuid": "",
    "info": "[Threat Intel] Chromium extension uses AI\u2011related branding to redirect browser search",
    "protected": false,
    "publish_timestamp": "1783858357",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1783858357",
    "uuid": "00d35c73-eafd-4baf-a679-95f8298ad720",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#96f4f6",
        "local": false,
        "name": "misp-galaxy:producer=\"Microsoft\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#72ee33",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Keylogging - T1056.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#ed66f6",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Steal Web Session Cookie - T1539\"",
        "relationship_type": ""
      },
      {
        "colour": "#77a4ec",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Email Collection - T1114\"",
        "relationship_type": ""
      },
      {
        "colour": "#7da4ad",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Match Legitimate Resource Name or Location - T1036.005\"",
        "relationship_type": ""
      },
      {
        "colour": "#47d9d3",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#029dd6",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Software Extensions - T1176\"",
        "relationship_type": ""
      },
      {
        "colour": "#bce57a",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over Web Service - T1567\"",
        "relationship_type": ""
      },
      {
        "colour": "#62e1b7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Browser Session Hijacking - T1185\"",
        "relationship_type": ""
      },
      {
        "colour": "#adf1b0",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Proxy - T1090\"",
        "relationship_type": ""
      },
      {
        "colour": "#08221e",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Steal Application Access Token - T1528\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Compromise Host Software Binary - T1554\"",
        "relationship_type": ""
      },
      {
        "colour": "#1acf09",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Trusted Relationship - T1199\"",
        "relationship_type": ""
      },
      {
        "colour": "#c84641",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"GUI Input Capture - T1056.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#1b95cd",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Phishing - T1566\"",
        "relationship_type": ""
      },
      {
        "colour": "#3b33aa",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Subvert Trust Controls - T1553\"",
        "relationship_type": ""
      },
      {
        "colour": "#356c41",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Encrypted Channel - T1573\"",
        "relationship_type": ""
      },
      {
        "colour": "#07a4a1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data Encoding - T1132\"",
        "relationship_type": ""
      },
      {
        "colour": "#a42e64",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data from Information Repositories - T1213\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Drive-by Compromise - T1189\"",
        "relationship_type": ""
      },
      {
        "colour": "#92e858",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#18005c",
        "local": false,
        "name": "rectifyq:topic=\"ai\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782874829",
        "to_ids": false,
        "type": "link",
        "uuid": "5200e58d-4b04-4653-8c77-5025671e5815",
        "value": "https://www.microsoft.com/en-us/security/blog/2026/06/29/chromium-extension-uses-airelated-branding-redirect-browser-search/"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782874829",
        "to_ids": false,
        "type": "text",
        "uuid": "ba785dfb-a5ac-4021-aae8-7eece7dd3b0b",
        "value": "Microsoft Threat Intelligence identified a malicious Chromium extension spoofing Perplexity AI to deceive users into installation. The extension's primary objective involves search traffic interception and data collection through Manifest Version 3 capabilities and declarativeNetRequest rules. It routes both full search queries and real-time keystrokes through attacker-controlled infrastructure hosted on a typosquatted domain before redirecting to legitimate search providers. The extension overrides browser default search settings, captures user input at keystroke-level, and uses suspicious permissions inconsistent with legitimate AI assistants. The threat demonstrates how actors operationalize AI branding as social engineering vectors. Google removed the extension following responsible disclosure. Organizations should strengthen user awareness training and implement layered security strategies to detect similar threats."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782874829",
        "to_ids": false,
        "type": "text",
        "uuid": "61c46726-73e2-4123-aa0a-86709b9c6436",
        "value": "Name: Chromium extension uses AI\u2011related branding to redirect browser search\nAuthor: AlienVault\nAdversary: \nTags: [\"keystroke capture\", \"typosquatting\", \"browser extension\", \"declarativenetrequest\", \"perplexity ai spoofing\", \"data interception\", \"search hijacking\", \"chrome extension\"]\nTgtd countries: []\nMlwr families: []\nAttack_ids: [\"T1056.001\", \"T1539\", \"T1114\", \"T1036.005\", \"T1204.002\", \"T1176\", \"T1567\", \"T1185\", \"T1090\", \"T1528\", \"T1554\", \"T1199\", \"T1056.002\", \"T1566\", \"T1553\", \"T1573\", \"T1132\", \"T1213\", \"T1189\", \"T1071.001\"]\nIndustries: [\"Technology\", \"Hospitality\"]"
      },
      {
        "category": "Network activity",
        "comment": "Typosquatted domain used for search redirection",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783847016",
        "to_ids": true,
        "type": "domain",
        "uuid": "3463c257-0d8a-4145-af35-ab128914992b",
        "value": "perplexity-ai.online",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Typosquatted domain used for search redirection",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783847037",
        "to_ids": true,
        "type": "url",
        "uuid": "fcf944f7-2dd2-4ef9-a9a5-2b273096afe8",
        "value": "http://perplexity-ai.online/",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783847058",
        "to_ids": true,
        "type": "url",
        "uuid": "f78b2ea4-950b-40c5-8c91-6417242d3b89",
        "value": "http://perplexity-ai.online/*",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783847079",
        "to_ids": true,
        "type": "url",
        "uuid": "08e090db-de90-42d9-a18b-29734e05566e",
        "value": "http://perplexity-ai.online/search/",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783847100",
        "to_ids": true,
        "type": "url",
        "uuid": "1422eaaf-f475-400d-b781-f1d622b14af8",
        "value": "https://perplexity-ai.online/favicon.ico",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783847121",
        "to_ids": true,
        "type": "url",
        "uuid": "855e9e74-d817-4d6b-8e6b-548b36c868b3",
        "value": "https://perplexity-ai.online/search/",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783847142",
        "to_ids": true,
        "type": "url",
        "uuid": "d2d42e1a-7c0b-48b7-9ac6-06d290601396",
        "value": "https://perplexity-ai.online/search?output=firefox&q=",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "Malicious Chromium extension",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783843066",
        "to_ids": true,
        "type": "chrome-extension-id",
        "uuid": "d9ceefa1-2ca9-4fa7-a445-58ffc3f01358",
        "value": "flkebkiofojicogddingbdmcmkpbplcd"
      },
      {
        "category": "Network activity",
        "comment": "Installation onboarding page",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783847163",
        "to_ids": true,
        "type": "url",
        "uuid": "38c3049b-ef50-4794-840b-ddb6a53669fc",
        "value": "extension.tilda.ws/perplexityai",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}